Limited vs Reasonable Assurance on Sustainability Statements: Common Mistakes for Auditors and Issuers

Under the Accounting Directive as consolidated on March 18, 2026, the sustainability reporting of an in-scope undertaking is subject to an opinion based on a limited assurance engagement, not reasonable assurance. Omnibus I removed the Commission's mandate to adopt reasonable assurance standards. It also pushed the deadline for EU limited assurance standards to July 1, 2027. The opinion is normally given by the statutory auditor, but Member States may allow another auditor or an accredited independent assurance services provider. Auditors approved before January 1, 2026 must first acquire sustainability knowledge through continuing education.

Limited vs reasonable assurance: where EU law stands today

For US readers, the key point is that the EU regime does not plan a step-up to reasonable assurance in the current texts. Any US assurance requirements are outside the scope of the CSRD & ESRS knowledge base, which covers EU law only.

What the assurance opinion actually covers

Article 34(1)(aa) sets the subject matter. A limited assurance opinion covers:

• compliance of the sustainability reporting with the Accounting Directive;
• compliance with the ESRS adopted under Article 29b;
• the process the undertaking used to identify the information reported, in practice the double materiality assessment;
• compliance with the requirement to mark up the sustainability reporting under Article 29d;
• compliance with the EU Taxonomy Article 8 reporting requirements.

Two limits matter in practice. First, Article 29d says that until marking-up rules are adopted in Delegated Regulation (EU) 2019/815, undertakings are not required to mark up their sustainability reporting. Second, Article 34(2a) requires the opinion to respect the right of value-chain undertakings with no more than 1,000 employees to decline information beyond the voluntary standard. An assurance provider should not treat a missing "beyond-the-cap" datapoint from such a supplier as a deficiency.

The written assurance report must identify the entity, the sustainability reporting and period covered, and the framework applied. It must describe the scope, including the assurance standards used, and contain the opinion. The statutory auditor carrying out the engagement signs and dates it (Audit Directive, Article 28a). For groups, the group auditor bears full responsibility for the report on consolidated sustainability reporting and must evaluate and review the work of other providers (Article 27a).

Assurance does not shift responsibility away from management. Article 33 of the Accounting Directive makes the members of the administrative, management and supervisory bodies collectively responsible for ensuring that the management report is drawn up and published in line with the directive, the ESRS and the Article 29d format requirements. Member States may exclude the Article 29d format requirements from that collective responsibility. For a US group, this means the directors of the EU reporting entity, not the auditor, own the sustainability statement.

Who can sign off

• The statutory auditor or audit firm that audits the financial statements, by default.
• Another statutory auditor or audit firm, if the Member State allows it (Article 34(3)).
• An independent assurance services provider (IASP), if the Member State allows it. An IASP is a conformity assessment body accredited under Regulation (EC) No 765/2008 for this specific activity. It must be subject to requirements equivalent to those for auditors, covering training, continuing education, quality assurance, ethics and independence, appointment and dismissal, investigations and sanctions, organization of work and reporting of irregularities (Article 34(4)). A Member State that allows IASPs must also allow a statutory auditor other than the financial auditor.
• Cross-border IASPs: from January 6, 2027, a Member State that uses the IASP option must allow IASPs established in other Member States to provide assurance (Article 34(5)).

Auditor qualification: the transitional rules

New entrants must pass an examination that covers sustainability subjects: the legal requirements and standards for sustainability reporting, sustainability analysis, due diligence processes, and the assurance standards (Article 8(3)). They also need at least eight months of practical training on sustainability assurance or related services (Article 10(1)). Article 14a sets the transition:

• auditors approved or recognized before January 1, 2024 are exempt from these additional exam and training requirements;
• people in the approval process on January 1, 2024 are also exempt, provided they completed it by January 1, 2026;
• auditors approved before January 1, 2026 who wish to perform sustainability assurance must acquire the necessary knowledge, including the Article 8(3) subjects, through continuing education.

IASPs have a parallel regime. Those accredited before January 1, 2024, or that completed an accreditation process under way on that date by January 1, 2026, are exempt from the training and examination requirements. They too must acquire the knowledge through continuing education.

Common mistakes for auditors and issuers

1. Promising or demanding reasonable assurance. The EU texts require limited assurance; there is no scheduled move to reasonable assurance in the consolidated Audit Directive.
2. Assuming EU standards already exist. Until the Commission adopts limited assurance standards (deadline July 1, 2027), national standards may apply. Check the Member State.
3. Assuming any auditor can sign. A long-standing statutory auditor approved before 2026 must still complete the sustainability continuing education before taking on these engagements.
4. Selecting an IASP where the Member State has not opted in. The IASP route exists only where national law allows it.
5. Testing the value chain beyond the cap. The opinion must respect protected undertakings' right to decline information beyond the voluntary standard.
6. Forgetting the Taxonomy and the materiality process. Both are inside the scope of the opinion.
7. For US issuers listed on an EU regulated market: relying on an unregistered non-EU auditor. Assurance reports by unregistered third-country auditors have no legal effect in that Member State. A transitional registration regime applies to reports for financial years starting from January 1, 2025 to December 31, 2030 (Audit Directive, Article 45(5b)).

For public-interest entities, the CSRD also amended Regulation (EU) No 537/2014. Audit committee pre-approval is not needed for the assurance of sustainability reporting, and preparing sustainability reporting is listed among the prohibited non-audit services.

Check a specific scenario by asking the base, for example: "I was approved as a statutory auditor before 2026 and never did any sustainability work. Can I still sign assurance opinions on sustainability reports?" Answers cite the consolidated Audit Directive and the consolidated Accounting Directive.

Based on EU texts indexed on October 5, 2026. This explains the rules; it is not legal or audit advice.